Configure your firewall to allow traffic to Agent DNS hostnames.

1. Sign in to the Arctic Wolf Unified Portal.
2. In the navigation menu, click Resources > Allowlist Requirements.
3. Configure your firewall to allow outbound traffic for all the hostnames, not IP addresses, listed in the Agent section.
   Note:

   Agent must contact Arctic Wolf servers to register. If this process fails, Agent retries every 15 seconds. This has no negative effect on the system.

1. Configure your security systems to allow the processes listed in Arctic Wolf Agent processes.
   Tip:

   Arctic Wolf recommends that you define a security rule or policy exclusion for the parent folder. Then, if new processes are added during a future Agent software update, the new rule or policy exclusion applies to it. For example, for a Windows endpoint, define a rule that applies to one of these file paths based on your Windows operating system (OS):

   • Windows 64-bit OS — C:\Program Files (x86)\Arctic Wolf Networks\

   • Windows 32-bit OS — C:\Program Files\Arctic Wolf Networks\

2. Add the files listed in Arctic Wolf Agent hash values to all allowlists.
3. If you use an EDR solution, verify that your EDR configuration changes are applied to all endpoints.

This step is optional.

1. Sign in to the Arctic Wolf Unified Portal.
2. In the navigation menu, click Resources > Downloads.
3. In the Arctic Wolf Agent section, in the Operating System list, select the required operating system.
4. Click Download Agent.
5. Copy the UUID value, and then save it in a safe, encrypted location. You will provide it to Arctic Wolf later.
6. Extract the contents of the Agent zip file.

   The MSI file and customer.json file are extracted.

7. Make sure that the MSI file and customer.json file are extracted into the same folder.

You must trust Agent scanner signed files to ensure Agent vulnerability and benchmark scanning is not impacted by other endpoint security tools installed on the endpoint.

VBScript must be enabled to install Arctic Wolf Agent.

1. Go to Start > Settings > System > Optional features.
2. Select View features.
3. In the search dialog, enter VBSCRIPT, and then select the check box for the VBScript search result.
4. To enable the VBScript feature, click Next.

For each user or machine, complete these steps:

1. Sign in to the server with administrator permissions.
2. Create a shared network folder for the installation files.
3. In the new window, right-click the Agent object, and then click Properties.
4. Click the Security tab.
5. Select a group or user.
6. In the Apply Group Policy section, select the Allow checkbox.

   The policy is applied to the specified groups.

7. Click OK.

1. Click Start, and then open the GPMC.
2. In the navigation menu, click Forest: <DomainName>, where DomainName is the name of your domain, and then click the Domains folder.
3. Right-click the domain name. If you:
   • Already have an Agent GPO — Select Link an Existing GPO, and then click Edit.
   • Do not have an existing Agent GPO — Create a new GPO:
     1. Select Create a GPO in this domain, and Link it here.
     2. In the New GPO dialog box, enter a name for the new GPO.
     3. Verify that the Source Starter GPO menu says (none).
     4. Click OK.
        Tip:

        To assign a security group and make sure that Agent is deployed to the correct group of computers, see Assign Security Group Filters to the GPO.

     5. Right-click the new GPO, and then click Enforced to enable it.

        The GPO is enabled. A lock appears on the GPO icon in the navigation menu.

     6. Right-click the new GPO, and then select Edit.
4. In the new window, right-click the Agent object, and then click Properties.
5. Click the Security tab.
6. Select a group or user.
7. In the Apply Group Policy section, select the Allow checkbox.

   The policy is applied to the specified groups.

8. Click OK.

1. Open the GPMC.
2. Right-click the Agent object that you created, and then click Edit.
3. In the navigation menu, click Computer Configuration > Policies > Software Settings.
4. Right-click Software Installation, and then click New > Package.
5. In the Open dialog, enter the full Universal Naming Convention (UNC) path of the distribution point containing the MSI file.
6. Select the MSI file to create the Agent package.
7. Click Open.
8. Click Assigned, and then click OK.

   The package is added to the Group Policy window.

9. Close the Group Policy snap-in, and then click OK to exit.

1. In a terminal, run this command:
   SHELLCopy

   gpupdate /force

   gpupdate /force

   Example of expected output:

   BASHCopy

   Computer Policy update has completed successfully. . . . Certain Computer policies are enabled that can only run during startup.

   Computer Policy update has completed successfully.
   .
   .
   .
   Certain Computer policies are enabled that can only run during startup.

2. When prompted, enter Y to restart your device and install Agent.
3. After your device restarts, sign in to the Arctic Wolf Unified Portal.
4. In the navigation menu, click Data Collection > Agents.
5. In the Agents table, verify that the Agent installed on your device appears.
   Note:

   If the Agent installed on your device does not appear in the Agents table within 1-2 minutes of device restart, contact your CST at security@arcticwolf.com.